Sign and verify models

You can sign and verify models in one of two ways, either by using a container that does the signing and verifying of artifacts, or by using a stand-alone executable to sign and verify your artifacts.

Sign and verify AI/ML models by using a container
Copy link

Use the RHTAS model-transparency CLI to sign and verify artificial intelligence and machine learning (AI/ML) models. The CLI requires your Trust Root configuration, but its commands run in a container image, so you do not need to install the binary locally.

Before you begin
Copy link

  • Installation of RHTAS running on Red Hat OpenShift Container Platform.
  • A running Securesign instance.
  • An OpenID Connect (OIDC) identity for retrieving tokens or client credentials.
  • A workstation with the podman binary installed.

About this task
Copy link

Important

Signing and verifying AI/ML models by using the CLI is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs), might not be functionally complete, and Red Hat does not recommend to use them for production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. See the support scope for Red Hat Technology Preview features for more details.

 Important

On RHTAS 1.2 and below, the Rekor key is configured to use SHA384 encryption. You must rotate the Rekor signer key to use SHA256. If you do not change the encryption type for Rekor, then verifying artifacts will cause mismatch errors.

For more information about this issue, see the RHTAS Release Notes.

Procedure
Copy link

  1. Configure your shell environment: 
    $ export OIDC_ISSUER="OIDC_ISSUER_URL"
$ export MODEL_IMAGE="registry.redhat.io/rhtas/model-transparency-rhel9@sha256:6db7fa2b956875a6f507811166b47b164d463dea78ab4403c6d7648d838b8acb"
$ export MODEL_DIR="PATH_TO_MODEL_DIRECTORY"
$ export TRUST_CFG="$(pwd)/trust_config.json"
$ export SIG_PATH="$MODEL_DIR/model.sig"

    Replace OIDC_ISSUER_URL with your OIDC provider URL address.

    Replace PATH_TO_MODEL_DIRECTORY with the absolute path to the directory containing the AI/ML models.

  2. There are two options for signing a model by using the CLI. You can use an identity token and a client identifier, or just the client identifier. Using an identity token is the non-interactive way, whereas using a client identifier is the interactive way.
    Note
    When using self-signed certificates or a custom Certificate Authority (CA), you have to pass those certificates to the container to successfully sign an AI/ML model.
    1. Option 1. Signing AI/ML models with an identity token: 
      $ podman run --rm \
--userns=keep-id --user "$(id -u)":"$(id -g)" --group-add keep-groups \
-v "$MODEL_DIR":/model:Z,U \
-v "$TRUST_CFG":/trust_config.json:Z,ro \
-w /model "$MODEL_IMAGE" \
sign sigstore \
--trust_config /trust_config.json \
--signature /model/model.sig \
--identity_token "OIDC_TOKEN" \
--client_id CLIENT_ID \
/model

      Replace OIDC_TOKEN with your OIDC authentication token.

      Replace CLIENT_ID with your OIDC client identifier.

    2. Option 2. Signing AI/ML models by using a client identifier: 
      $ podman run --rm -it \
--userns=keep-id --user "$(id -u)":"$(id -g)" --group-add keep-groups \
-v "$MODEL_DIR":/model:Z,U \
-v "$TRUST_CFG":/trust_config.json:Z,ro \
-w /model "$MODEL_IMAGE" \
sign sigstore \
--trust_config "/trust_config.json" \
--signature "/model/model.sig" \
--client_id CLIENT_ID \
/model

      Replace CLIENT_ID with your OIDC client identifier.

  3. Verify a model signature that uses the CLI: 
    $ podman run --rm -it \
--userns=keep-id --user "$(id -u)":"$(id -g)" --group-add keep-groups \
-v "$MODEL_DIR":/model:Z,U \
-v "$TRUST_CFG":/trust_config.json:Z,ro \
-w /model "$MODEL_IMAGE" \
verify sigstore \
--trust_config "/trust_config.json" \
--signature "/model/model.sig" \
--identity IDENTITY \
--identity_provider "$OIDC_ISSUER" \
/model

    Replace IDENTITY with an email address or with a SPIFFE or URI subject.

Sign and verify artificial intelligence and machine learning models by using the model transparency command-line tool
Copy link

Use the model transparency CLI to sign and verify artificial intelligence and machine learning (AI/ML) models, ensuring their integrity and authenticity. Models can be stored in a local directory or an Open Container Initiative (OCI) image registry such as Quay.io.

Before you begin
Copy link

  • Installation of the RHTAS operator running on Red Hat OpenShift Container Platform.
  • A running Securesign instance.
  • Your OpenID Connect (OIDC) issuer URL, and user credentials for signing and verifying your ML models.
  • Python 3.10 or later installed on your workstation.
  • A workstation with the oc, pip, and curl binaries installed.

Procedure
Copy link

  1. Open a terminal, and install the model transparency CLI Python package to your workstation: 
    $ pip install rh-model-signing
  2. Download a copy of the trust root from your OpenShift cluster to your workstation: 
    $ export TUF_URL=$(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)
$ curl -o root.json $TUF_URL/root.json
  3. Bootstrap the trust root before signing or verifying any models: 
    $ rh_model_signing trust-instance $TUF_URL root.json
  4. Different ways to sign your AI/ML models:
    Sign a local ML model directory
    $ rh_model_signing sign sigstore PATH_TO_MODEL --instance $TUF_URL --client-id trusted-artifact-signer

    Replace PATH_TO_MODEL with the path to your local ML model directory.

    Sign an OCI model artifact or image with a registry attachment
    $ rh_model_signing sign sigstore PATH_TO_REGISTRY:TAG --instance $TUF_URL --client-id trusted-artifact-signer

    Replace PATH_TO_REGISTRY:TAG with the URL to your OCI image and the tag for the image.

    Sign an OCI model artifact or image but outputting the signature as a separate file
    $ rh_model_signing sign sigstore PATH_TO_REGISTRY:TAG --output-mode file --signature PATH_TO_MODEL_SIGNATURE --instance $TUF_URL --client-id trusted-artifact-signer

    Replace PATH_TO_REGISTRY:TAG with the URL to your OCI image and the tag for the image. Replace PATH_TO_MODEL_SIGNATURE with the path to the file containing the signature for the ML model.

    Sign and attach by using the tag-based method
    $ rh_model_signing sign sigstore PATH_TO_REGISTRY:TAG --attachment-mode tag --instance $TUF_URL --client-id trusted-artifact-signer

    Replace PATH_TO_REGISTRY:TAG with the URL to your OCI image and the tag for the image.

  5. Different ways to verify your AI/ML models:
    Verify a local AI/ML model directory
    $ rh_model_signing verify sigstore PATH_TO_MODEL --signature model.sig --identity "jdoe@example.com" --identity-provider "OIDC_ISSUER_URL" --instance $TUF_URL

    Replace PATH_TO_MODEL with the path to your local ML model directory. Replace OIDC_ISSUER_URL with the URL to your OpenID Connect (OIDC) issuer.

    Verify an OCI image from a registry
    $ rh_model_signing verify sigstore PATH_TO_REGISTRY:TAG --identity "jdoe@example.com" --identity-provider "OIDC_ISSUER_URL" --instance $TUF_URL

    Replace PATH_TO_REGISTRY:TAG with the URL to your OCI image and the tag for the image. Replace OIDC_ISSUER_URL with the URL to your OIDC issuer.

    Verify an OCI image with a local signature file
    $ rh_model_signing verify sigstore PATH_TO_REGISTRY:TAG --signature PATH_TO_MODEL_SIGNATURE --identity "jdoe@example.com" --identity-provider "OIDC_ISSUER_URL" --instance $TUF_URL

    Replace PATH_TO_REGISTRY:TAG with the URL to your OCI image and the tag for the image. Replace PATH_TO_MODEL_SIGNATURE with the path to the file containing the signature for the ML model. Replace OIDC_ISSUER_URL with the URL to your OIDC issuer.

    Verify and attach by using the tag-based method
    $ rh_model_signing verify sigstore PATH_TO_REGISTRY:TAG --attachment-mode tag --identity "jdoe@example.com" --identity-provider "OIDC_ISSUER_URL" --instance $TUF_URL

    Replace PATH_TO_REGISTRY:TAG with the URL to your OCI image and the tag for the image. Replace OIDC_ISSUER_URL with the URL to your OIDC issuer.